Privacy Policy

• Account data: email address, username, display name, password (stored only as a hash) and, if you sign in with Google, the identifier and profile picture Google shares with us.
• Profile and content: what you put on your profile (headline, bio, skills, links, avatar and cover image) and what you make and send in the app: messages, files, drawings, screenplays, tasks, and the projects and teams you are in.
• Usage data: server logs with IP address, browser and timestamps, kept for security and debugging; which versions of the app you downloaded and use, how long the app was open each day (you see these on your own page), and the errors the app ran into.
• Preferences: the language you pick is saved on your account (and in a small cookie); light or dark mode and reduced motion are stored in your browser only.

To run the Service: signing you in, showing your profile and what you share to the people you share it with, delivering notifications you have enabled, sending account emails (verification, password reset), preventing abuse and rate-limiting, and improving Devchaos based on aggregate usage. We do not sell personal data and we do not show third-party advertising. Notification emails (invitations, tasks, missed messages) are sent only while your email notifications are on. You can stop them with one click from the link in the email, or in your account settings.

For signed-in members we keep a record of the account:

• Signing in and out: when, with the IP address and the browser or app.
• Online status: when you last used Devchaos.

Only Devchaos's admins can read this record. It is there to notice abuse and accounts that were taken over, and to help when you ask for support. Sign-ins are deleted after 90 days. If you turn off “Show when I'm online” in your account settings, every other member sees you as offline at all times; the admins still see it.

• Other users: your profile, and what you share with them in a project, a conversation or a call. Email addresses are never shown to other users.
• Service providers that process data on our behalf: hosting and database providers, file storage (the files members send and keep in the app are stored with Cloudflare R2), our email delivery provider (for account and notification emails) and Google (only if you use Google sign-in). GIFs in messages are searched for through our server and loaded from GIPHY, which then sees your IP address as any website does.
• GGDB: as a sub-site, Devchaos may share aggregate statistics with the GGDB platform.
• Authorities, when the law requires it or to protect users from harm.

If Google Analytics is switched on for this site, your browser loads a script from Google and sends it a page view: the address you opened, where you arrived from, your approximate location, and the kind of device and browser you use. Google sets its own cookies to recognise a returning browser. We ask it to shorten your IP address before it is stored, we never send it your name, e-mail or anything you have written, and we use what comes back only as counts — which pages are read, where readers come from — never to single anyone out. You can stop it entirely with any browser setting or extension that blocks analytics, and the site works exactly the same without it. When it is off, no third-party script is loaded on any page.

We use a session cookie to keep you signed in and a short-lived cache of your session to keep pages fast; both are essential and HTTP-only. One small preference cookie remembers the language you picked, so a page opens in it straight away. Light or dark mode and reduced motion live in your browser's local storage. We do not use tracking or advertising cookies.

Account data stays until you delete your account. Server logs are kept for a limited period for security purposes. Deleting your account removes your profile, your sign-in and what only you owned; a project with a team is handed to the member who has been in it longest, and what you wrote to others stays with them without your name. Backups are purged on their normal rotation. Messages in the app are kept for 180 days and are then deleted together with the files sent in them; this applies to direct and group conversations and to the channels of a project whose files Devchaos keeps. A project's own files (designs, drawings, screenplays, tasks) are not deleted by time. If a project keeps its files on the studio's own computer, those files are stored only there: Devchaos holds no copy of them and is not responsible for them, and that project's messages are kept without a time limit. Voice calls and screen sharing are carried live by a media server we run ourselves and are not recorded.

In your account settings you can change your password, manage notifications, disconnect Google, download a copy of the data Devchaos holds about you as one file, and delete your account. Your profile is edited in the app. To change your email address, or for anything else, contact us. Depending on where you live you may also have rights of access, correction, portability, restriction and objection — contact us and we will help.

Devchaos is not intended for children under 16 (or the age of digital consent where you live). If you believe a child has created an account, contact us and we will remove it.

Passwords are hashed, sessions use HTTP-only cookies, pictures you upload are re-encoded before they are served and every write to the database checks who is asking. No system is perfectly secure, so please use a unique password and tell us if you notice anything suspicious.

If we change how we handle personal data in a meaningful way we will announce it on the Service before the change takes effect.

Privacy questions or requests: use the contact page.